WordPress security changelog
MEDIUM CVE-2026-39647 Deferred

MP3 Audio Player for Music, Radio & Podcast by Sonaar: Server-side request forgery

MP3 Audio Player for Music, Radio & Podcast by Sonaar is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests. The published affected range is <= 5.11.

CVE / CNA score 5.4 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Plugin slug
mp3-music-player-by-sonaar
Affected
<= 5.11
Safe version
> 5.11
Published
Apr 08, 2026
Weakness
CWE-918 — Server-Side Request Forgery (SSRF)

This CVE was published Apr 08, 2026 and is one of 11 known issues for this plugin.

What to do

Patch or disable the affected component.

Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to a release after 5.11, or disable and remove it until a fixed version is available.

Source record

Technical description

Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.11.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources